Audit package attribute reads and choose fact/assertion shape.

FLEX-WP-0025-T01/T02: keep merged attributes, add registry/asserted
namespaces later, and declare the remaining ceiling keys so no
published allowlist is unbacked. T03 stays waiting on validate.

Assistant: grok
Assistant-Session: 01a09dc1-b21e-77e1-919e-fcad2f82b267

examples/user-engine/registry_snapshot.json

@@ -14,5 +14,21 @@
     "actions": [],
     "metadata": {"flex_auth_contract":"protected-system-v0","dynamic_actions":true}
   }],
-  "resource_manifests": [], "tenants": [], "subjects": [], "groups": [], "relationships": []
+  "resource_manifests": [],
+  "tenants": [],
+  "subjects": [
+    {
+      "id": "registration-applicant",
+      "type": "Human",
+      "display_name": "Public registration applicant",
+      "organization_relation": "Customer",
+      "roles": ["registration-applicant"],
+      "tenant": "tenant:friendly:binky",
+      "claims": {
+        "issuer": "urn:netkingdom:public-registration"
+      }
+    }
+  ],
+  "groups": [],
+  "relationships": []
 }